"Software stack" is doing a lot of work there. Are you shaking a stick at Microsoft's entire product offering?

Microsoft deserves criticism, but not all of the criticism it gets.

This is a long comment already, so I'll only touch on windows itself.

Going back in time, the whole "Internet security" thing was not an issue that the sector perceived until there was already a huge install base. Longhorn reveals the intent to sort out the security issues. It''s harsh to judge XP for being vulnerable to the explosion of the Internet and the proliferation of new vectors, without also recognising the improvements that the next iteration brought.

Vista shipped with:

- firewall on and default-deny inbound
- privilege separation by default
- remote shell and rdp disabled
- default SMB shares requiring admin
- tray notifications of insecure settings with buttons to restore secure settings
- trust zones
- aslr
- driver signing requirements

This was roughly commensurate with OSX at the time.

Auditing and template-based secpol was in NT; Windows logging out-of-the-box is comparable to Fedora or Ubuntu. Windows logging is approximately feature-equivalent to rsyslog.

Windows is the OS for users who don't know shit, and that creates a burden of default services. Their surface area to support is necessarily larger than in your favourite distro. It's disingenuous to ignore that in an analysis. PWASAUL (people who are smug about using linux) have to ignore that to protect their opinion. Let's be better.

Example: the print spooler on windows is exploitable. That's clearly a vuln from a code error. IMO, any argument that it's _also an insecure default_ is trumped by the requirement for network printing to work for Evelyn, 62, with her crappy Canon. Criticism for the vuln is valid; criticism for the default service is less so, and that's what I'm addressing in this comment.

Lateral movement is possible in any network, but not a gimme in a windows network. You can't just telnet from box to box any more; you have to find unpatched vulns, same as with other OSes. Hopefully, heartbleed has demonstrated that "Linux and yolo" is not a security posture.

You could argue either way whether sshd or rpc is a bigger attack surface. Hardening ssh is not a box-tick if you still need to use it to manage services; there's work to do, and it's not clear to me that it beats the effectiveness of the same amount of effort spent hardening a windows network. A minimal AD build is very granular about who can do what.

Example: local admins are unprivileged over the network, which is equivalent to denying sudo over SSH for pam users. You have to implement that yourself on Linux.

Example: agent forwarding is allowed by default in sshd in Ubuntu, IIRC, but double-hop is disabled by default in a windows network. Those features are not the same, but I take it as a more secure default on windows than linux.

To put Microsoft's security sins into perspective:

- I have a bank account that asks for my mother's maiden name
- there are countries where it's possible to steal property by convincing the land registry that you bought it
- retail services on my country mostly do "two-factor" by email or SMS

Microsoft is way better than most companies.

They should be better still, but let's not conflate then with Experian, or Lastpass, or Sony. Those guys were playing on easy mode and got shown up. Microsoft has complexity that few companies face. Amazon and Google may do better, but they have second-mover advantage.